DevSecOps & Secure Pipelines

SAST reads source without running it and finds insecure code paths. DAST probes a running instance and sees runtime behaviour, not source. SCA checks declared dependencies for known-vulnerable versions. Each covers a different defect class.

Scanners match known credential patterns and flag high-entropy strings — as a pre-commit hook, in CI, and across history. Pre-commit catches leaks early but is bypassable, so the CI check enforces. It misses novel formats and rotates nothing.

A scanner report is a hypothesis list, not a bug list — static analysis over-approximates, so many findings are unreachable or already mitigated. Triage confirms exploitability, then sets severity and an owner. Noise teaches developers to ignore the tool.

A lockfile pins the exact version and hash of every dependency, direct and transitive, so a rebuild fetches the same bytes and a republished package fails verification. Signatures add provenance, and a registry proxy blocks confusable names.

No. Treat it as compromised the moment it landed — clones, forks, CI logs and mirrors hold it, and a force-push removes nothing from them. Rotate first, then audit its use over the exposure window. Scrubbing history is cleanup, not remediation.

Block only high-confidence, high-severity classes — a verified secret, a critical reachable dependency — and warn on the rest. Break-glass is a self-service label that ships but alerts security and opens a timed ticket. Suppressions are reviewed, owned and expiring.

Start in warn mode and baseline existing findings so teams see only new ones. Ship scanning as an inherited central pipeline template, so it is default-on and removal is visible. Onboard by risk. Central owns tuning and triage, teams own fixes. Report time to remediate and bypass rate, not raw counts.

Priority is risk, not a severity score alone — combine severity with exploitation signals, reachability, and asset exposure. Tiers attach to that composite and the clock starts at triage. Base-image findings route to the platform team by ownership metadata. Breaches escalate to a time-boxed risk acceptance.

The scan cannot fail the build — continue-on-error: true swallows its exit code and Gate hardcodes exit 0. It also echoes the token into a log and runs write-all on an unpinned action. Gate on the real exit code, drop the echo, rotate the token, scope permissions, pin by SHA.

Scan plan output, not just source, in the pull request and again at apply. Rules are versioned policy code with their own tests, scoped per environment so sandbox differs from production. Roll out in warn mode with an expiring baseline, and let only the pipeline identity apply.

First establish exposure — query the inventory for affected artifacts and which are internet-facing. With no fix yet, buy time with compensating controls: disable the feature, filter the input at the edge, tighten egress. Patch to a pinned release once one ships.

Existing and reachable differ. SCA flags a version, but the vulnerable function may never be called from your code. Reachability analysis walks the call graph from your entry points; nothing reaching the sink means latent risk — lower priority, still patched.

An SBOM is a machine-readable inventory of every component and version actually in a build, including transitive ones, emitted from the resolved dependency tree. A scan gives today's findings; the SBOM answers later which shipped artifacts hold a component.

Declare an incident with one commander and one inventory of record. Query the inventories you have, then scan running artifacts to close the gap. Sequence by exposure — internet-facing first. For vendor images use network mitigations while pressing the supplier. Afterwards make build-time inventories mandatory.